summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* resolve: refuse mdns scope for ipv4 broadcast addressesRonan Pigott2023-04-054-4/+22
| | | | This query can never be answered, so let's no wait for it to timeout.
* Merge pull request #27143 from bluca/no_tpmZbigniew Jędrzejewski-Szmek2023-04-051-0/+4
|\ | | | | cryptsetup: fix build without TPM2
| * cryptsetup: fix build without TPM2Luca Boccassi2023-04-041-0/+4
| | | | | | | | Follow-up for acbb504eaf1be51572b1c0d0d490ac478bc41c64
* | service: use newdup() where appropriateLennart Poettering2023-04-051-2/+1
| |
* | Merge pull request #27137 from yuwata/id128-get-machineYu Watanabe2023-04-0514-90/+112
|\ \ | | | | | | sd-id128: introduce id128_get_machine() and _at()
| * | machine-id-setup: do not read host's machine ID when root directory is specifiedYu Watanabe2023-04-051-10/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a root directory is specified, and e.g. /var under the root directory is a symlink to the host's /var, then we wrongly read host's machine ID, even if O_NOFOLLOW is set. Let's chase the path with CHASE_NOFOLLOW to refuse such case. Also, refuse null ID, otherwise we may setup machine ID with NULL.
| * | machine-id-setup: use id128_get_machine() at one more placeYu Watanabe2023-04-051-4/+1
| | |
| * | discover-image: use id128_get_machine() at one more placeYu Watanabe2023-04-051-17/+3
| | |
| * | specifier: always convert missing machine-id file to EUNATCHYu Watanabe2023-04-052-14/+4
| | | | | | | | | | | | Then, use id128_get_machine().
| * | nspawn: ignore NULL machine ID in the containerYu Watanabe2023-04-051-11/+1
| | | | | | | | | | | | | | | | | | | | | | | | Previously, when the NULL (all zero) machine ID is configured in the container, nspawn refused to execute. Now id128_get_machine() is used, so NULL machine ID is refused with -ENOMEDIUM, and fallback to specified UUID or randomly generated one.
| * | repart: use id128_get_machine()Yu Watanabe2023-04-051-16/+6
| | | | | | | | | | | | | | | This also makes that the seed is actually randomized when the read machine ID is NULL.
| * | test: add tests for id128_get_machine() and _at()Yu Watanabe2023-04-051-0/+10
| | |
| * | sd-id128: introduce id128_get_machine() and id128_get_machine_at()Yu Watanabe2023-04-052-0/+37
| | |
| * | fd-util: introduce dir_fd_is_root_or_cwd()Yu Watanabe2023-04-053-8/+6
| | |
| * | test: add tests for ID128_REFUSE_NULLYu Watanabe2023-04-051-0/+20
| | |
| * | sd-id128: introduce ID128_REFUSE_NULL flagYu Watanabe2023-04-053-10/+19
| | |
* | | various: simplify calls to parse_boolean_argument()Zbigniew Jędrzejewski-Szmek2023-04-055-56/+30
| |/ |/| | | | | | | parse_boolean_argument() returns the same information via both the output argument and normal return.
* | tpm2: fix nits from PR #26185William Roberts2023-04-043-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: - Comment style - Alignment style - cleanup macro usage - incorrect error message[1] 1. Thanks to tempusfugit991@gmail.com for pointing out the error message mistake. Signed-off-by: William Roberts <william.c.roberts@intel.com>
* | execute: add one more assert()Lennart Poettering2023-04-041-0/+2
| |
* | Merge pull request #27128 from keszybz/sd-bus-docs-and-error-messagesZbigniew Jędrzejewski-Szmek2023-04-048-134/+134
|\ \ | |/ |/| Improvements to man pages for systemd.service, sd-bus, and better error messages
| * sd-bus: use macros for standard bus error names consistentlyZbigniew Jędrzejewski-Szmek2023-04-044-67/+70
| | | | | | | | | | Also add definitions for a few names that didn't have them and update the list in the man page.
| * core: a more informative error when SetProperties/StartTransientUnit failsZbigniew Jędrzejewski-Szmek2023-04-041-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I was changing how some properties are appended to the StartTransientUnit call and messed up the message contents. When something is wrong with how the message is structed, we would return a very generic "Failed to start transient service unit: No such device or address". Mention that it was property setting that failed, and translate ENXIO to a different message. bus_unit_set_properties() or any of the children it calls may also return other errors, in particular EBADMSG or ENOMEM, but the error message that is generated for those is understandable, so we don't need to "translate" them explicitly. bus_unit_set_properties() is called from two places, so it seems nicer to generate the message internally, rather than ask the caller to do that. Also, now bus_unit_set_properties() always sets <error>, which is nicer for the callers.
| * core: unify two similar paths, avoid formatting of unused stringZbigniew Jędrzejewski-Szmek2023-04-041-26/+21
| | | | | | | | | | | | | | | | After 'if (DEBUG_LOGGING)' is added, the two call sites are almost identical, except that we forgot LOG_UNIT_INVOCATION_ID(unit). I removed the handling of the log_oom(). It's a debug message only after all, and it's unlikely to fail.
| * core: simplify unit_escape_setting()Zbigniew Jędrzejewski-Szmek2023-04-042-17/+11
| | | | | | | | | | | | | | | | | | | | | | The function had a provision for NULL input, and would return NULL, but that looks like an error and all callers pass in a non-NULL arg and report oom on NULL. So assert that the input is non-NULL. All callers specifed the output buffer, so we can simplify the logic to only make an allocation if appropriate and change the return type to 'const *'. No functional change.
| * core: typos in commentsZbigniew Jędrzejewski-Szmek2023-04-044-15/+14
| |
* | service: minor modernizationsLennart Poettering2023-04-041-13/+13
| |
* | manager: remove transient unit directory during startupZbigniew Jędrzejewski-Szmek2023-04-041-0/+4
| | | | | | | | | | | | | | | | | | | | I was testing transient units and user@.service crashed. I restarted it, and tried to create a transient unit. It failed because /run/user/1000/systemd/transient/ remained after the previous aborted run: Failed to start transient service unit: Unit run-u0.service was already loaded or has a fragment file. Remove the directory during initial startup so we don't get confused by our own files.
* | service: dump fdstore contents also in free-form debug dumpLennart Poettering2023-04-041-0/+39
| |
* | Merge pull request #27122 from yuwata/id128-atDaan De Meyer2023-04-046-26/+117
|\ \ | | | | | | undefined
| * | test: add tests for id128_{read,write}_at()Yu Watanabe2023-04-041-0/+74
| | |
| * | sd-id128: introduce id128_write_at()Yu Watanabe2023-04-042-4/+8
| | |
| * | sd-id128: introduce id128_read_at()Yu Watanabe2023-04-042-4/+10
| | |
| * | sd-id128: rename Id128FormatFlag -> Id128FlagYu Watanabe2023-04-042-13/+13
| | | | | | | | | | | | As the flag is not only for formatting.
| * | sd-id128: rename argument and add missing assertionYu Watanabe2023-04-042-6/+10
| | |
| * | Revert "sd-id128: make id128_read() optionally take root directory"Yu Watanabe2023-04-045-13/+16
| | | | | | | | | | | | This reverts commit 830e52caa2bf1a29f56cb93e7ed85acb1bda11c3.
* | | chase: fix error handlingYu Watanabe2023-04-041-2/+2
|/ / | | | | | | Fixes a bug introduced by 63bfd52f48a772c86ff84e3a1ba1fcd19e0008f8.
* | src: changed usage of basename() to path_extract_filename().OMOJOLA JOSHUA DAMILOLA2023-04-042-7/+19
| | | | | | | | TODO.
* | Merge pull request #27114 from keszybz/trivial-cleanupsLuca Boccassi2023-04-034-15/+7
|\ \ | | | | | | Trivial cleanups
| * | shared/exec-util: reduce scope of iterator variablesZbigniew Jędrzejewski-Szmek2023-04-031-6/+3
| | |
| * | core/service: inline one variableZbigniew Jędrzejewski-Szmek2023-04-031-3/+1
| | |
| * | basic/fs-util: typo fixZbigniew Jędrzejewski-Szmek2023-04-031-1/+1
| | |
| * | basic/mkdir: simplify error handlingZbigniew Jędrzejewski-Szmek2023-04-031-5/+2
| |/ | | | | | | | | | | | | | | | | | | If we created the dir successfully, we let chmod_and_chown_at() do its thing and shouldn't go into the part where we check if the existing directory has the right permissions and ownership and possibly adjust them. The code was doing that, by relying on the fact that chmod_and_chown_at() does not return -EEXIST. That's probably true, but seems unnecessarilly complicated. Follow-up for c1b1492a94b43ca636eb383c3b058feff27ff7b1.
* | pid1: drop two spurious empty lineLennart Poettering2023-04-031-2/+0
| |
* | core/main: also check the argument terminatorMike Yuan2023-04-031-1/+1
| | | | | | | | | | | | | | For future-proof reasons, in case we will add another option that starts with --deserialize. Addresses https://github.com/systemd/systemd/commit/4f44d2c4f76922a4f48dd4473e6abaca40d7e555#r107285603
* | udev-rules: check tokens orderDmitry V. Levin2023-04-031-0/+17
|/ | | | | When invoked by udevadm verify, warn about rules that have PROGRAM assignments specified after RESULT checks.
* tpm2: add support for a trusted SRKWilliam Roberts2023-04-0312-68/+485
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent attackers from spoofing the tpmKey portion of the AuthSession by adding a trusted key to the LUKS header metadata. Also, use a persistent object rather than a transient object. This provides the following benifits: 1. No way to MITM the tpmKey portion of the session, see [1] for details. 2. Strengthens the encrypted sessions, note that the bindKey could be dropped now. 3. Speed, once it's created we just use it. 4. Owner Auth is needed to call create primary, so using the SRK creates a scratch space for normal users. This is a "first to set" model, in where the first person to set the key in the LUKS header wins. Thus, setup should be done in a known good state. If an SRK, which is a primary key at a special persistent address, is found, it will use whatever is there. If not, it creates an SRK. The SRK follows the convetions used through the tpm2-software organization code on GitHub [2], however, a split has occured between Windows and Linux with respect to SRK templates. The Linux SRK is generated with the unique field size set to 0, in Windows, it properly sets the size to key size in bytes and the unique data to all 0's of that size. Note the proper templates for SRKs is covered in spec [3]. However, the most important thing, is that both SRKs are passwordless, and thus they should be interchangable. If Windows is the first to make the SRK, systemd will gladly accept it and vice-versa. 1. Without the bindKey being utilized, an attacker was able to intercept this and fake a key, thus being able to decrypt and encrypt traffic as needed. Introduction of the bindKey strengthened this, but allows for the attacker to brute force AES128CFB using pin guesses. Introduction of the salt increases the difficulty of this attack as well as DA attacks on the TPM objects itself. 2. https://github.com/tpm2-software 3. https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf Fixes: #20668 Fixes: #22637 Signed-off-by: William Roberts <william.c.roberts@intel.com>
* Merge pull request #27044 from bluca/sysext_recursive_dirLennart Poettering2023-04-038-66/+88
|\ | | | | Ensure sysexts do not contain an os-release file, do not load sysexts from /usr[/local]/lib/extensions/
| * sysext: validate that they do not contain os-releaseLuca Boccassi2023-03-305-57/+77
| | | | | | | | | | sysexts are not supposed to ship os-release files, enforce this when loading them
| * sysext: stop storing under /usr/lib[/local]/extensions/Luca Boccassi2023-03-301-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sysexts are meant to extend /usr. All extension images and directories are opened and merged in a single, read-only overlayfs layer, mounted on /usr. So far, we had fallback storage directories in /usr/lib/extensions and /usr/local/lib/extensions. This is problematic for three reasons. Firstly, technically, for directory-based extensions the kernel will reject creating such an overlay, as there is a recursion problem. It actively validates that a lowerdir is not a child of another lowerdir, and fails with -ELOOP if it is. So having a sysext /usr/lib/extensions/myextdir/ would result in an overlayfs config lowerdir=/usr/lib/extensions/myextdir/usr/:/usr which is not allowed, as indicated by Christian the kernel performs this check: /* * Check if this layer root is a descendant of: * - another layer of this overlayfs instance * - upper/work dir of any overlayfs instance */ <...> /* Walk back ancestors to root (inclusive) looking for traps */ while (!err && parent != next) { if (is_lower && ovl_lookup_trap_inode(sb, parent)) { err = -ELOOP; pr_err("overlapping %s path\n", name); Secondly, there's a confusing aspect to this recursive storage. If you have /usr/lib/extensions/myext.raw which contains /usr/lib/extensions/mynested.raw 'systemd-sysext merge' will only pick up the first one, but both will appear in the merged root under /usr/lib/extensions/. So you have two extension images, both appear in your merged filesystem, but only one is actually in use. Finally, there's a conceptual aspect: the idea behind sysexts and hermetic /usr is that the /usr tree is not modified locally, but owned by the vendor. Dropping extensions in /usr thus goes contrary to this foundational concept.
| * rename extension-release.[c|h] -> extension-util.[c|h]Luca Boccassi2023-03-307-6/+6
| | | | | | | | | | It will be used for other extension DDI validation, not just for extension-release validation
View Lorry Controller Status